PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46169 Linux CVE debrief

A use of uninitialized value vulnerability exists in the Linux kernel's HFS+ filesystem driver. When mounting a corrupted HFS+ filesystem, the hfs_brec_read() function fails to validate that the on-disk catalog record size matches the expected size for the record type being read. This allows a partial read where fewer bytes are read than expected, leaving portions of a 520-byte structure uninitialized. The uninitialized data in the thread record's nodeName field is subsequently copied and used as array indices in case_fold(), triggering KMSAN warnings and potentially leading to out-of-bounds memory access. The vulnerability was discovered by Syzbot and affects kernel versions prior to the fix. The fix introduces hfsplus_brec_read_cat() to validate record sizes based on type, with minimum size checks for thread records and defensive initialization of temporary variables.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-19
Advisory published
2026-05-28
Advisory updated
2026-06-19

Who should care

Linux system administrators, kernel maintainers, security teams managing systems that process HFS+ filesystem images, virtualization platforms allowing guest filesystem access, and forensic analysis environments handling untrusted disk images

Technical summary

The vulnerability exists in fs/hfsplus/catalog.c where hfs_brec_read() reads catalog records without validating that entrylength matches the expected record size. For catalog thread records (type HFSPLUS_FOLDER_THREAD or HFSPLUS_FILE_THREAD), the expected size is 520 bytes, but corrupted filesystems may specify smaller sizes. The function only validates that entrylength does not exceed buffer size, not that it meets minimum requirements. When a 26-byte record is read into a 520-byte structure, 494 bytes remain uninitialized. The hfsplus_cat_build_key_uni() function copies this data, and hfsplus_strcasecmp() uses uninitialized nodeName.length bytes as indices into the case_fold_table array. The fix introduces hfsplus_brec_read_cat() with type-aware size validation: fixed 520 bytes for folder/file records, variable size for thread records with HFSPLUS_MIN_THREAD_SZ check before accessing nodeName.length. Defensive initialization of tmp in hfsplus_find_cat() provides additional protection.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates from official Linux stable tree once available for your distribution
  • Restrict mounting of untrusted HFS+ filesystem images
  • Monitor for kernel KMSAN warnings related to hfsplus_strcasecmp or hfs_brec_read
  • Review systems that process external HFS+ filesystem images for isolation

Evidence notes

Vulnerability confirmed via official Linux kernel stable tree commits. Syzbot reported the KMSAN uninit-value issue. Fix validated through multiple stable kernel branches.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46169 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46169

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46169 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46169

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/61a790974ff7e533acbceca06c7d02f22bf96d4d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/93e8d613f1a01b6637f387cc93f184cf7fb881d6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a420904450962a562ad053a41a53a27755021b48

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b6b592275aeff184aa82fcf6abccd833fb71b393

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c91bbd6193c70a02c50c22e0fb1f60c3c5bd053a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.